In this module, we're going to do a quick demo here,
and it's something that you can use to show how Terrascan
would operate in a real life scenario.
So first,
I'm going to open a pull request against a
repository that I'm making a change to,
and that pull request is going to run Terrascan,
and then I'll merge the pull request,
and we'll delegate the apply to Terraform Cloud.
Let's get started.
So I'm here in my GitHub repository,
and there is a couple of things that we want to go through first.
First, I've got main.tf, which is what we've been using this whole time.
I've fixed all of the issues here just for the demo,
so nothing should pop up on our Terrascan action.
And then I have another branch here.
If I go over to this other branch.
As of the time of this recording,
HashiCorp has updated their Terraform AWS provider,
so if I go back here into main.tf, it looks a little bit different.
This is going to be exactly the same bucket with the exactly
the same configuration as the main branch,
but because of the provider changes, this is how this code looks.
It's a little bit different.
It's broken out into multiple resources,
instead of just attributes of one resource.
So let's go back here to the master branch, and go into my GitHub workflow.
I've got a single GitHub workflow here,
and the first thing I'm going to do is run Terrascan,
so that's between Lines 8 and 26.
We did this a little bit in the last section,
but this time, it's going to run to completion.
And then if I scroll down a little bit,
this is another Terraform action that will run a validate plan format,
all of those other Terraform commands that we want when
we're doing a Terraform workflow.
And also to make this effective,
I want to go up here to Settings, and then look at my Branches,
and then go under Branch protection rules, and hit Edit here,
and you'll see that I've got this Terraform action
set as a branch protection rule.
So what that means is that this GitHub action has to
pass successfully if I want to merge.
If I don't set this as a Branch protection rule or if I
don't require that the status passes, even if there is a failure,
I can still merge my branch.
This isn't a requirement, but it is a best practice,
so something to keep in mind.
For now, let's go back to my Demo‑Repo here,
and I'll open up a new pull request.
And you see I've done this a few times already,
but this will just go over the deltas and the changes.
I'll go ahead and hit Create, and assign this to myself.
When I open this pull request,
it's going to kick off that Terraform action with
Terrascan and the Terraform validate, init,
and so on.
So you've seen this run already.
Let me go over to the Actions tab,
and this will just give you an idea that this is running,
this is going to make sure that all of my Terraform code is valid,
all of it has passed its Terrascan checks,
and like I said, I've already made sure that this is going to pass.
So let's go back here to the pull request and wait for these checks to finish.
Alright, that didn't take long at all.
So you see GitHub actions has commented on this pull request,
all of my checks have passed, including Terrascan.
In this case, I'm actually delegating the plan to Terraform Cloud,
so you'll see here that Terraform, I've got a Terraform Cloud workspace set up,
and it's running the plan and apply process once this gets merged,
but also important to note that my Terrascan action also passed successfully.
So if I go here, Terrascan is right there, and it did pass.
And then once I merge this,
I've got another workflow for Terraform Cloud that will pick up the
changes and then run this in a Terraform Cloud run.
So that's how Terrascan can be used in a more realistic scenario.
And with that, I'll go ahead and wrap up this course.
Thank you all so much for watching, and I hope to see you all next time.